Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Answers 2 answers
  • Subscribers 4 subscribers
  • Views 7317 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Protection Error and Windows Updates

Navar Holmes

Been fighting this common error that endpoints randomly generate.

This is not the Web Control policy, it is the built-in web protection.

Code: a058000c - Web Protection is no longer functional.  The filtering driver has been bypassed or unloaded.

The finger is pointing to windows updates but how and why is still being looked at.

We use an internal update server.  For windows updates that require a restart they are pushed at a specific once a week.

A large number of the endpoints that generate the error are within 30 minutes of that specific time.

What we don't know is why and if web protection is broken just during the update or is staying broken until a restart is done.

Another thought that is being looked at is the web protection just bouncing during the update and the SEC or Endpoint gets confused and doesn't clear the error that has been sent to the SEC.

There is other PCs that generate this during other times and the thought there is these PC are off line when the update when out and they got the update when they where powered on.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Navar Holmes,

    We have a KB article that covers that error message. Please have a look:
    Sophos Enterprise Console: error a058000c 

    If that doesn't help, then I would recommend that you start by determining what is causing the issue (for example, reboot a machine to see if that triggers it, without the Windows update). 
    If you test and determine that t it only occurs when Windows is updated, you should be able to see a list of installed updates (in win 10 Control Panel --> Programs and Features --> View installed updates) , and test if removing the latest ones (one at a time) changes the behavior. 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

Reply
  • 0

    Hello Navar Holmes,

    We have a KB article that covers that error message. Please have a look:
    Sophos Enterprise Console: error a058000c 

    If that doesn't help, then I would recommend that you start by determining what is causing the issue (for example, reboot a machine to see if that triggers it, without the Windows update). 
    If you test and determine that t it only occurs when Windows is updated, you should be able to see a list of installed updates (in win 10 Control Panel --> Programs and Features --> View installed updates) , and test if removing the latest ones (one at a time) changes the behavior. 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

Children
  • 0 in reply to Barb@Sophos

    KB114350 has nothing to do with this error as this error has nothing web control.  Web control has never been enabled.

    Both support and I have tried KB114350 and determined that it wont fix the is or come close.

    When you go here is web protection that is triggering not web control.

    http://sophostest.com/malware/index.html

    It is not any single windows update as this issue has been happening for well over a years if not longer and we apply windows updates weekly.

    I already have an open ticket with support to try and figure out why this is happening.

    10.8 was to fix this error but it had no effect on it.

    I currently have 22 workstations (No Servers but I do have servers with other sohpos errors) with this error which is about how many I acknowledge every couple of weeks.

    Only a restart of the workstation will clear the error from SEC but web protection is working before the restart is done and this has been verified many times by the URL above.

  • 0 in reply to Navar Holmes

    Hello Navar Holmes,

    Can you please share the ticket number (via DM) so that I can review it?
    I will also to monitor it for any required updates to our documentation. 

    Thank you,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • 0 in reply to Barb@Sophos

    Want to give everyone an updated as to what support is telling me about the Web Protection Error.

    We have confirmed that the warning message populates in SEC because of a timing condition when the services start. The web control and web protection features are fully functional.

    To me this means it is a confirmed bug, and that you really have no way of knowing if Web Protection is really working other than by testing it.

    So for now your options are to "Acknowledge" and restart the endpoint when time permits.

Unfiltered HTML